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MN receives agent 
advertisement from Mobility 
Agent (MA) indicating that 
mobile node should obtain IP 
address from DHCP server and 

determines from agent 
advertisement that the MN is in 
different zone from the MA 
(SEE FIG. 7) 
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MN performs DHCP discover 
and obtains IP address from 
DHCP server 



304 



Mobile node views MA as HA 

and attempts to send 
registration request to the MA 
(SEE FIG. 8) 
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308 



MA indirectly authenticates 
registration request 




MA constructs RADIUS access request 
including an 1) authentication attribute 
including authentication information 
from the MN-AAA extension and a 2) 
key request attribute requesting that 
HAAA set up key to be shared by MA 
and MN 
(SEE FIG. 9) 
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312 



MA send access 
request to FAAA 
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FAAA sends the 
access request to 
HAAA 



316 



HAAA authenticates the 
mobile node using the 
authentication 
information 
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Registration request A 
authenticated J 
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/Shared key generated anch 
^ provided to MA and MN J 
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328 



HAAA generates a key to 
be shared by MA and MN 
and encrypts 1) MA key 
using HAAA-FAAA key and 
2) MN key using HAAA-MN 
key (pre-configured) 
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330 



MA key and MN 
key provided in 
attribute in access 
accept message 
(SEE FIG. 10) 



HAAA sends 
access accept 
message to 
FAAA 
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FAAA decrypts MA 
key (optionally 
encrypts using 
FAAA-MA key) 
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FAAA forwards 
access accept to 
MA 



338 



MA obtains MA key 
from access accept 
packet decrypts MA 
key, stores MA key 



340 



342 



MA obtains MN 
key from access 
accept packet 
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Send 
RADIUS 
access 

reject 



FIG. 3 



MA composes registration 

reply packet indicating MN 
needs to re-register with 

key provided in the 
registration reply packet 
and having MN-MA key 
reply extension including 
the MN key and a MHAE 

extension including a hash 
of MA key 

(SEE FIG. 11A&FIG.11B) 
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MA sends the 
registration reply 
packet to MN 
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MN receives 
registration 
reply 
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MN obtains 
the MN key 
from the 
registration 
reply 
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MN decrypts 
the MN key 
and stores 
the MN key 
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MN authenticates 
'the registration reply' 
(MN verifies MN-MA 
shared key) 



352 
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MN runs hash 
algorithm using 
the MN key to 
obtain hash of 
registration reply 
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MN obtains hash 
of reply from 
MHAE of the 
registration reply 
(built using MA 
key) 
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MN compares 
hash of reply built 
using MN key 
and MA key to 
ensure MN and 
MA share same 
key 
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/I MN re-registers^v J 
( using the MN-MA K 
V shared key J 



MN re-registers 
with the MA with [y 
the new MN key 
(SEE FIG. 12) 
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MN receives agent 
advertisement from Mobility 
Agent (MA) indicating that 
mobile node should obtain IP 
address via the MA and 
determines from agent 
advertisement that the MN is in 
different zone from the MA 
(SEE FIG. 7) 
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Mobile node composes 
registration request and 
sends registration 
request to MA 
(SEE FIG. 13) 
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MA indirectly 
authenticates 
registration request 
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406 



MA constructs RADIUS access 

request including an 1) 
authentication attribute including 
authentication information from the 

MN-AAA extension, a 2) key 
request attribute requesting that 
HAAA set up key to be shared by 

MA and MN,and 3) VSE- 
indicating that FAAA to assign HA 
(SEE FIG. 14) 
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MA send 
access request 
to FAAA 



410 



FAAA obtains VSE 

and sends the 
access request to 
HAAA 



412 



HAAA authenticates 
the mobile node 

using the 
authentication 
information 
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Send 
RADIUS 
access 

reject 



(Registration request 
authenticated 
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(Shared key generated and\ 
provided to MA and MN J 



424 



HAAA generates a key to be 
shared by MA and MN and 
encrypts 1) MA key using 
HAAA-FAAAkeyand 2) MN 
key using HAAA-MN key (pre- 
configured) 
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Encrypted MA key and 
encrypted MN key provided in 
attributes 1, 2 or access 
accept message 
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HAAA sends 
access accept 
message to 
FAAA 



FAAA selects one of local 
HAs (inc. MA) and provides 
assigned HA in vendor 
specific attribute 3 in 
access accept 
(SEE FIG. 15) 



430 



FAAA decrypts MA key 
(optionally encrypts 
using FAAA-MA key) 



432 
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FAAA forwards j 

access accept to K 
MA 
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436 



MA obtains MA key from 
access accept packet, \y 
decrypts MA key, caches 
MA key for a period of time 

438 | ^ 



MA obtains 
MN key from 

access 
accept packet 
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MA composes registration reply packet 
identifying the assigned HA, indicating 
MN needs to re-register with assigned 
HA with key provided in the registration 
reply packet, and having MN-MA-HA 
key reply extension including the MN 
key and a MHAE extension including a 
hash of reply using MA key 
(SEE FIG. 16) 
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MA sends the 
registration reply 
packet to MN 
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MN receives 
registration 
reply 
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MN obtains the 
MN key from 
the registration 
reply 
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MN decrypts 
the MN key and y 
stores the MN 
key 
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/ MN authenticates 
/ the registration reply \ 
I (MN verifies MN-MA J 
V shared key) J 
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MN runs hash 
algorithm using 
the MN key to 
obtain hash of 
registration reply 



MN obtains hash 
of registration 
reply built using 
MA Key from the 
registration reply 
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MN compares 
hash of reply 
packet built using 
MN key and MA 
key to ensure MN 
and MA share 
same key 
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MN re-registers 
using the MN-MA- 
HA shared key 



MN registers with 
assigned HA with 
the new MN key 
(SEE FIG. 4B) 
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MN constructs second 
registration request: 1) 
HA = L_HA2 2) Home 

Address = 0 
3) MHAE 

(SEE FIG. 17) 
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MA receives registration 
request and generates: 4) 
MN-HA key reply extension 
including encrypted MA key 5) 
FHAE and appends 4 & 5 to 
the registration request 



MA forwards 
registration 
request to L_HA2 



466 



L_HA2 
authenticates 
registration 
request based on 
FHAE 
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470 



L_HA2 obtains key 
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L_HA2 obtains 
the MA key from 
the registration 
request 



472 



L_HA2 decrypts the 
MA key 



474 



L_HA2 stores the 
MA key 



476 
478 



LA_HA2 authenticates the 
/ registration request using the MA 
I key (L_HA2 verifies MN-MA-LJHA2, 
n/ shared key) 



L_HA2 runs hash 
algorithm using the MA 
key to obtain hash of 
registration request 
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L_HA2 obtains hash of 

registration request 
generated using the MN 
key from the registration 
request 
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L_HA2 compares hash of 
registration request generated 
using MN key with that 
generated using MA key to 
ensure MN and L_HA2 share 
same key 



LJHA2 assigns IP 
address to the MN 

and sends 
registration reply 
including assigned IP 
address 



MA receives the 
registration reply 



488 



MA removes the 
cached MA key 
from cache 
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MA forwards 
registration reply 
to the MN 



492 



MN receives agent advertisement 
from Mobility Agent (MA) indicating 
that mobile node should obtain IP 
address from DHCP server and 

determines from agent 
advertisement that the MN is in 
same zone as the MA 
(SEE FIG, 7) 
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MN performs 
DHCP discover 
and obtains IP 
address from 
DHCP server 
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Mobile node 
views MA as HA 
and attempts to 
send registration 
request to the MA 

(SEE FIG. 18) 
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508 



MA indirectly authenticates 



gistration request via AAA server/ 



MA constructs RADIUS access 

request including an 1) 
authentication attribute including 
authentication information from the 
MN-AAA authentication extension 
(SEE FIG. 19) 
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MA send access 
request to AAA 



512 



AAA authenticates 
the mobile node using \y 
the authentication 
information 
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Send 
RADIUS 
access 
reject 
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AAA encrypts the 
MA key using 
AAA-MA key 
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Encrypted MA 
key provided in 

attribute in 
access accept 

message 



526 



AAA sends 
access accept 
message to MA 
(SEE FIG. 20) 
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MA creates 
binding in mobility 
binding table for 
MN 
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MA obtains MA 
key from access 
accept packet 
decrypts MA key, 
stores MA key 



532 



MA composes 
™ registration reply 
packet having MHAE 
^ extension using MA 
key 

(SEE FIG. 20) 
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MA sends the 
registration reply 
packet to MN 



MN receives 
registration reply 



536 



MN obtains the 
MA key from the 
registration reply 



538 



MN authenticates 
the registration 
reply using the 
MA key 
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FIG. 5 



MN receives agent 
advertisement from Mobility 
Agent (MA) indicating that 
mobile node should obtain IP 
address via the MA and 
determines from agent 
advertisement that the MN is 
in same zone as the MA 
(SEE FIG. 7) 
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Mobile node composes 
registration request 

and sends registration 
request to MA 
(SEE FIG. 21) 
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f MA indirectly 
(authenticates registration 
\request via AAA server, 




606 



MA constructs RADIUS 
access request including an 
1) authentication attribute 
including authentication 
information from the MN-AAA 
extension 2) VSE - indicating 
that AAA to assign HA 
(SEE FIG. 22) 
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MA send access 
request to AAA 



610 



AAA obtains 
VSE 



612 



AAA authenticates 
the mobile node 

using the 
authentication 
information 
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Send 
RADIUS 
access 

reject 
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sgistration request 
authenticated 
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624 



AAA obtains MN-HA key 
(key to be shared by MA 
and MN) and encrypts 
MN-HA key using 
AAA-MA key 
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AAA selects one ot local 

HAs (inc. MA) and 
provides assigned HA in 
vendor specific attribute 2 
in access accept 
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Encrypted MN-HA key 
provided in attribute 1 of 
access accept message 
(SEE FIG. 23) 



628 



AAA sends 
access accept 
message to MA 



630 



MA obtains MA key 
from access accept 
packet, decrypts MA 
key, caches MA key 
for a period of time 



632 



MA composes 
registration reply packet 
identifying the assigned 
HA, indicating MN needs 

to re-register with the 
assigned HA, and having 
MHAE extension 
including hash of the 
registration reply using 
MA key 
(SEE FIG. 24) 
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MA sends the 
registration reply 
packet to MN 
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MN receives 
registration reply 
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638 



MN authenticates the 
registrator reply (MN verifies) 
V MN-MA shared key) 



MN runs hash 
algorithm using 
the MN key to 
obtain hash of 
the registration 
reply 
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640 



MN obtains hash 
of the registration 
reply generated 
using the MA key 

from the 
registration reply 
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MN compares hash of 

registration reply 
generated using the MN 
Tcey with that generated 

using the MA key to 
ensure WIN and MA share 
same key 

I 
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f MN obtains \ J 
I. assigned HAy 



MN determines 
from error code 
that MN needs 
to re-register 
with assigned 
HA 
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MN obtains the 
assigned HA 
from 
registration reply 
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MN re-registers with 
assigned hA 
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MN registers 
with assigned 
HA with MN key 
(SEE FIG. 6B) 
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MN constructs 
second registration 
request: 1) HA = 
L_HA2 2) Home 
Address = 0 

3) MHAE 
(SEE FIG. 17) 
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658 



MA receives registration 
request and generates: 4) 
MN-HA key reply extension 
including encrypted MA key 
5) FHAE 



MA forwards 
registration 
request to 
L HA2 
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L_HA2 
authenticates 
registration 
request based 
on FHAE 
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664 



f LJHA2 obtains key and 
( completes authentication of ] 
V registration request J 



LJHA2 obtains 
the MA key from 
the registration 
request 
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L_HA2 decrypts the 
MA key 



668 

V 



L_HA2 stores 
the MA key 
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672 



LAJHA2 authenticates the 
'registration request using the IWO 
key (L_HA2 verifies MN-MA- 
L_HA2 shared key) 
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L_HA2 runs hash 
algorithm using the 
MA key to obtain 
hash of MA key 
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L_HA2 obtains hash 
of MN key from the 
registration request 
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676 



L_HA2 compares 
hash of MN key and 
hash of MA key to 

ensure MN and 
L_HA2 share same 
key 
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680 



L_HA2 assigns IP 
address to the MN 

and sends 
registration reply 
including assigned 

IP address 



682 



MA receives the 
registration reply 



684 



MA removes the 
cached MA key 
from cache 
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MA forwards 
registration reply 
to the MN 



Mobility Agent 
Advertisement 
^ 702 ^ 704 



706 



Agent 
advertisement - 
providing mobility 
services (e.g., H 
and F bit set) 



Extension 1 : Zone 



Extension 2: 
Obtain IP address 
from DHCP server 
(or MA) 
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Registration request 
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804 



806 



Registration request: 
1) Home Address = 
DHCP address 
2) Home Agent address 
= MA address 


NAI Extension 


MN-MA key request 
extension indicating to 
HAAA to set up key to be 
shared by MA and MN 
(used to authenticate MA 
and MN) 


MN-AAA authentication 
extension including hash 

value of registration 
request using shared key 
between MN and HAAA 



FIG. 8 



Access request 

^902 ^904 



906 



Access request 



Key request attribute 
indicating to HAAA to set 
up key to be shared by 
MA and MN (used to 
authenticate MA and 
MN) 



Authentication attribute 
including hash value 

generated using shared 
key between MN and 
HAAA 
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Registration reply 
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FIG. 11A 
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Registration reply 


Vendor specific 
extension: indicate that 
mobile node needs to 

obtain MN key to 
authenticate message 
and re-register with the 
MN key 


Key reply 
extension: 
MN key 


MHAE including 
hash of reply using 
the MA key 
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Registration reply 

1106 



1108 



Registration reply 
Error code (e.g., 0 indicating 
registration successful, new 
key error code indicating that 

the mobile node needs to 
obtain MN key and re-register 

with the MN key) 



Key reply 
extension: 
MNkey 



MHAE including hash of 
reply using the MA key 



FIG. 11B 



Registration request 
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1204 



Registration request: 
1) Home Address = 
DHCP address 
2) Home Agent address 
= MA address 



NAI Extension 



MHAE authentication 
extension including 
hash value generated 

using the MN key 
shared by the MN and 
the MA 
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Registration request 
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1306 



Registration request: 
1)Home Address = 0 
2) Home Agent address = 
0 indicating load balancing 
desired 


NAI extension including 
mobile node identifier 


MN-MA key request 
extension indicating 
to HAAA to set up 
key to be shared by 
MA and MN (used to 
authenticate MA and 
MN) 


MN-AAA 
authentication 
extension including 
hash value 
generated using 
shared key between 
MN and HAM 
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Access request 
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Access request 



1404 



Key request attribute 
indicating to HAM to 
set up key to be shared 
by MA and MN (used to 
authenticate MA and 
MN) 
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1408 



Authentication attribute 
including hash value 

generated using shared 
key between MN and 
HAAA 



Vendor specific attribute 
indicating FAAA to 
assign HA 



FIG. 14 



1502 



Access accept 
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Access accept 
1504 



MA key 



1506 



MN key 



1508 



Assigned HA (e.g., L- 
HA2) 
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Registration reply 
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Registration reply - HA = 
assigned HA (e.g., LJHA2) 


Key reply extension: 
MN key 


Vendor specific 
extension: indicate that 
mobile node needs to 

obtain MN key to 
authenticate message 
and re-register with the 
assigned HA with the 
MN key 


MHAE including hash 
of registration reply 
generated using MA 
key 
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Registration reply 
Error code (e.g., 0 indicating 
registration successful, new key 
error code indicating that the 
mobile node needs to obtain 
MN key and re-register with the 
MN key) 



FIG, 16 



Registration request 
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1706 



1708 



Registration request: 
1) Home Address = 0 
2) Home Agent address 
= assigned HA (e.g., 
L_HA2) 


MHAE authentication 
extension including hash 
value of reply generated 
using the MN key shared 

by the MN and the MA 


MN-HA key reply 
extension including 
encrypted MA key 


FHAE (e.g., MA-LJHA2) 



FIG. 17 
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Registration request: 
1) Home Address = 
DHCP address 
2) Home Agent address = 
MA address 


MN-AAA authentication 
extension including hash 
value generated using 
shared key (MA key) 
between MN and AAA 


FIG 
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Access request 
^1902 ^1904 


Access request 


MN-AAA attribute 
including hash value 
generated using shared 
key (MA key) between 
MN and AAA 
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^2002 


Access accept f 


Access accept 


MH-AE Encrypted 
MA key 
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Registration request 
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2104 



Registration request: 
1) Home Address = 0 
2) Home Agent address = 0 
indicating load balancing 
desired 



NAI extension including 
mobile node identifier 



MN-AAA authentication 
extension including 
hash value generated 
using the shared key 
between MN and AAA 



FIG. 21 
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Access request 
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2206 



Access request 



MN-AAA attribute 
including hash value for 
shared key (MA key/ 
MN-HA key) between 
MN and AAA 



Vendor specific 
extension indicating 
FAAA to assign HA 



FIG. 22 
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Access accept 
•2304 
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Access accept 



MN-HA key encrypted 
with AAA-MA key 



Vendor specific 
extension indicating 
assigned HA (e.g., 
LJHA2) 
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Registration reply 
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2406 



Registration reply - HA 
assigned HA (e.g., 
L_HA2) 



Registration reply 
Error code (e.g., 0 
indicating registration 
successful, new HA error 
code indicating that the 
mobile node needs to 
obtain HA and use this 
HA in subsequent 
requests) 



MHAE including hash 
value generated using 
MA key 



FIG. 24 
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